4 security IDL structures
8 pointer_default(unique)
13 access masks are divided up like this:
16 a = generic rights bits SEC_GENERIC_
18 c = standard rights bits SEC_STD_
19 d = object type specific bits SEC_{FILE,DIR,REG,xxx}_
21 common combinations of bits are prefixed with SEC_RIGHTS_
23 const int SEC_MASK_GENERIC
= 0xF0000000;
24 const int SEC_MASK_FLAGS
= 0x0F000000;
25 const int SEC_MASK_STANDARD
= 0x00FF0000;
26 const int SEC_MASK_SPECIFIC
= 0x0000FFFF;
29 const int SEC_GENERIC_ALL
= 0x10000000;
30 const int SEC_GENERIC_EXECUTE
= 0x20000000;
31 const int SEC_GENERIC_WRITE
= 0x40000000;
32 const int SEC_GENERIC_READ
= 0x80000000;
35 const int SEC_FLAG_SYSTEM_SECURITY
= 0x01000000;
36 const int SEC_FLAG_MAXIMUM_ALLOWED
= 0x02000000;
39 const int SEC_STD_DELETE
= 0x00010000;
40 const int SEC_STD_READ_CONTROL
= 0x00020000;
41 const int SEC_STD_WRITE_DAC
= 0x00040000;
42 const int SEC_STD_WRITE_OWNER
= 0x00080000;
43 const int SEC_STD_SYNCHRONIZE
= 0x00100000;
44 const int SEC_STD_REQUIRED
= 0x000F0000;
45 const int SEC_STD_ALL
= 0x001F0000;
47 /* file specific bits */
48 const int SEC_FILE_READ_DATA
= 0x00000001;
49 const int SEC_FILE_WRITE_DATA
= 0x00000002;
50 const int SEC_FILE_APPEND_DATA
= 0x00000004;
51 const int SEC_FILE_READ_EA
= 0x00000008;
52 const int SEC_FILE_WRITE_EA
= 0x00000010;
53 const int SEC_FILE_EXECUTE
= 0x00000020;
54 const int SEC_FILE_READ_ATTRIBUTE
= 0x00000080;
55 const int SEC_FILE_WRITE_ATTRIBUTE
= 0x00000100;
56 const int SEC_FILE_ALL
= 0x000001ff;
58 /* directory specific bits */
59 const int SEC_DIR_LIST
= 0x00000001;
60 const int SEC_DIR_ADD_FILE
= 0x00000002;
61 const int SEC_DIR_ADD_SUBDIR
= 0x00000004;
62 const int SEC_DIR_READ_EA
= 0x00000008;
63 const int SEC_DIR_WRITE_EA
= 0x00000010;
64 const int SEC_DIR_TRAVERSE
= 0x00000020;
65 const int SEC_DIR_DELETE_CHILD
= 0x00000040;
66 const int SEC_DIR_READ_ATTRIBUTE
= 0x00000080;
67 const int SEC_DIR_WRITE_ATTRIBUTE
= 0x00000100;
69 /* registry entry specific bits */
70 const int SEC_REG_QUERY_VALUE
= 0x00000001;
71 const int SEC_REG_SET_VALUE
= 0x00000002;
72 const int SEC_REG_CREATE_SUBKEY
= 0x00000004;
73 const int SEC_REG_ENUM_SUBKEYS
= 0x00000008;
74 const int SEC_REG_NOTIFY
= 0x00000010;
75 const int SEC_REG_CREATE_LINK
= 0x00000020;
77 /* generic->specific mappings for files */
78 const int SEC_RIGHTS_FILE_READ
= SEC_STD_READ_CONTROL |
81 SEC_FILE_READ_ATTRIBUTE |
84 const int SEC_RIGHTS_FILE_WRITE
= SEC_STD_READ_CONTROL |
87 SEC_FILE_WRITE_ATTRIBUTE |
91 const int SEC_RIGHTS_FILE_EXECUTE
= SEC_STD_SYNCHRONIZE |
92 SEC_STD_READ_CONTROL |
93 SEC_FILE_READ_ATTRIBUTE |
96 const int SEC_RIGHTS_FILE_ALL
= SEC_STD_ALL | SEC_FILE_ALL
;
98 /* generic->specific mappings for directories (same as files) */
99 const int SEC_RIGHTS_DIR_READ
= SEC_RIGHTS_FILE_READ
;
100 const int SEC_RIGHTS_DIR_WRITE
= SEC_RIGHTS_FILE_WRITE
;
101 const int SEC_RIGHTS_DIR_EXECUTE
= SEC_RIGHTS_FILE_EXECUTE
;
102 const int SEC_RIGHTS_DIR_ALL
= SEC_RIGHTS_FILE_ALL
;
105 /***************************************************************/
106 /* WELL KNOWN SIDS */
109 const string SID_NULL
= "S-1-0-0";
111 /* the world domain */
112 const string SID_WORLD_DOMAIN
= "S-1-1";
113 const string SID_WORLD
= "S-1-1-0";
115 /* SECURITY_CREATOR_SID_AUTHORITY */
116 const string SID_CREATOR_OWNER_DOMAIN
= "S-1-3";
117 const string SID_CREATOR_OWNER
= "S-1-3-0";
118 const string SID_CREATOR_GROUP
= "S-1-3-1";
120 /* SECURITY_NT_AUTHORITY */
121 const string SID_NT_AUTHORITY
= "S-1-5";
122 const string SID_NT_DIALUP
= "S-1-5-1";
123 const string SID_NT_NETWORK
= "S-1-5-2";
124 const string SID_NT_BATCH
= "S-1-5-3";
125 const string SID_NT_INTERACTIVE
= "S-1-5-4";
126 const string SID_NT_SERVICE
= "S-1-5-6";
127 const string SID_NT_ANONYMOUS
= "S-1-5-7";
128 const string SID_NT_PROXY
= "S-1-5-8";
129 const string SID_NT_ENTERPRISE_DCS
= "S-1-5-9";
130 const string SID_NT_SELF
= "S-1-5-10";
131 const string SID_NT_AUTHENTICATED_USERS
= "S-1-5-11";
132 const string SID_NT_RESTRICTED
= "S-1-5-12";
133 const string SID_NT_TERMINAL_SERVER_USERS
= "S-1-5-13";
134 const string SID_NT_REMOTE_INTERACTIVE
= "S-1-5-14";
135 const string SID_NT_THIS_ORGANISATION
= "S-1-5-15";
136 const string SID_NT_SYSTEM
= "S-1-5-18";
137 const string SID_NT_LOCAL_SERVICE
= "S-1-5-19";
138 const string SID_NT_NETWORK_SERVICE
= "S-1-5-20";
140 /* SECURITY_BUILTIN_DOMAIN_RID */
141 const string SID_BUILTIN
= "S-1-5-32";
142 const string SID_BUILTIN_ADMINISTRATORS
= "S-1-5-32-544";
143 const string SID_BUILTIN_USERS
= "S-1-5-32-545";
144 const string SID_BUILTIN_GUESTS
= "S-1-5-32-546";
145 const string SID_BUILTIN_POWER_USERS
= "S-1-5-32-547";
146 const string SID_BUILTIN_ACCOUNT_OPERATORS
= "S-1-5-32-548";
147 const string SID_BUILTIN_SERVER_OPERATORS
= "S-1-5-32-549";
148 const string SID_BUILTIN_PRINT_OPERATORS
= "S-1-5-32-550";
149 const string SID_BUILTIN_BACKUP_OPERATORS
= "S-1-5-32-551";
150 const string SID_BUILTIN_REPLICATOR
= "S-1-5-32-552";
154 privilege IDs. Please keep the IDs below 64. If we get more
155 than 64 then we need to change security_token
158 SEC_PRIV_SECURITY
= 1,
160 SEC_PRIV_RESTORE
= 3,
161 SEC_PRIV_SYSTEMTIME
= 4,
162 SEC_PRIV_SHUTDOWN
= 5,
163 SEC_PRIV_REMOTE_SHUTDOWN
= 6,
164 SEC_PRIV_TAKE_OWNERSHIP
= 7,
166 SEC_PRIV_SYSTEM_ENVIRONMENT
= 9,
167 SEC_PRIV_SYSTEM_PROFILE
= 10,
168 SEC_PRIV_PROFILE_SINGLE_PROCESS
= 11,
169 SEC_PRIV_INCREASE_BASE_PRIORITY
= 12,
170 SEC_PRIV_LOAD_DRIVER
= 13,
171 SEC_PRIV_CREATE_PAGEFILE
= 14,
172 SEC_PRIV_INCREASE_QUOTA
= 15,
173 SEC_PRIV_CHANGE_NOTIFY
= 16,
174 SEC_PRIV_UNDOCK
= 17,
175 SEC_PRIV_MANAGE_VOLUME
= 18,
176 SEC_PRIV_IMPERSONATE
= 19,
177 SEC_PRIV_CREATE_GLOBAL
= 20,
178 SEC_PRIV_ENABLE_DELEGATION
= 21,
179 SEC_PRIV_INTERACTIVE_LOGON
= 22,
180 SEC_PRIV_NETWORK_LOGON
= 23,
181 SEC_PRIV_REMOTE_INTERACTIVE_LOGON
= 24
185 /* a domain SID. Note that unlike Samba3 this contains a pointer,
186 so you can't copy them using assignment */
187 typedef [public,noprint
] struct {
188 uint8 sid_rev_num
; /**< SID revision number */
189 [range(0,15)] int8 num_auths
; /**< Number of sub-authorities */
190 uint8 id_auth
[6]; /**< Identifier Authority */
191 uint32 sub_auths
[num_auths
];
194 typedef [bitmap8bit
] bitmap
{
195 SEC_ACE_FLAG_OBJECT_INHERIT
= 0x01,
196 SEC_ACE_FLAG_CONTAINER_INHERIT
= 0x02,
197 SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
= 0x04,
198 SEC_ACE_FLAG_INHERIT_ONLY
= 0x08,
199 SEC_ACE_FLAG_INHERITED_ACE
= 0x10,
200 SEC_ACE_FLAG_VALID_INHERIT
= 0x0f,
201 SEC_ACE_FLAG_SUCCESSFUL_ACCESS
= 0x40,
202 SEC_ACE_FLAG_FAILED_ACCESS
= 0x80
203 } security_ace_flags
;
205 typedef [enum8bit
] enum {
206 SEC_ACE_TYPE_ACCESS_ALLOWED
= 0,
207 SEC_ACE_TYPE_ACCESS_DENIED
= 1,
208 SEC_ACE_TYPE_SYSTEM_AUDIT
= 2,
209 SEC_ACE_TYPE_SYSTEM_ALARM
= 3,
210 SEC_ACE_TYPE_ALLOWED_COMPOUND
= 4,
211 SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
= 5,
212 SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
= 6,
213 SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
= 7,
214 SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
= 8
218 SEC_ACE_OBJECT_TYPE_PRESENT
= 0x00000001,
219 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
= 0x00000002
220 } security_ace_object_flags
;
222 typedef [nodiscriminant
] union {
223 /* this is the 'schemaIDGUID' attribute of the attribute object in the schema naming context */
224 [case(SEC_ACE_OBJECT_TYPE_PRESENT
)] GUID type
;
226 } security_ace_object_type
;
228 typedef [nodiscriminant
] union {
229 /* this is the 'schemaIDGUID' attribute of the objectclass object in the schema naming context
230 * (of the parent container)
232 [case(SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] GUID inherited_type
;
234 } security_ace_object_inherited_type
;
237 security_ace_object_flags flags
;
238 [switch_is(flags
& SEC_ACE_OBJECT_TYPE_PRESENT
)] security_ace_object_type type
;
239 [switch_is(flags
& SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
)] security_ace_object_inherited_type inherited_type
;
240 } security_ace_object
;
242 typedef [nodiscriminant
] union {
243 [case(SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
)] security_ace_object
object;
244 [case(SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
)] security_ace_object
object;
245 [case(SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
)] security_ace_object
object;
246 [case(SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
)] security_ace_object
object;
248 } security_ace_object_ctr
;
250 typedef [public] struct {
251 security_ace_type type
; /* SEC_ACE_TYPE_* */
252 security_ace_flags flags
; /* SEC_ACE_FLAG_* */
253 [value
(ndr_size_security_ace
(r
))] uint16 size
;
255 [switch_is(type
)] security_ace_object_ctr
object;
260 SECURITY_ACL_REVISION_NT4
= 2,
261 SECURITY_ACL_REVISION_ADS
= 4
262 } security_acl_revision
;
264 const uint NT4_ACL_REVISION
= SECURITY_ACL_REVISION_NT4
;
266 typedef [public] struct {
267 security_acl_revision revision
;
268 [value
(ndr_size_security_acl
(r
))] uint16 size
;
269 [range(0,1000)] uint32 num_aces
;
270 security_ace aces
[num_aces
];
273 /* default revision for new ACLs */
274 typedef [enum8bit
] enum {
275 SECURITY_DESCRIPTOR_REVISION_1
= 1
276 } security_descriptor_revision
;
278 const int SD_REVISION
= SECURITY_DESCRIPTOR_REVISION_1
;
280 /* security_descriptor->type bits */
281 typedef [bitmap16bit
] bitmap
{
282 SEC_DESC_OWNER_DEFAULTED
= 0x0001,
283 SEC_DESC_GROUP_DEFAULTED
= 0x0002,
284 SEC_DESC_DACL_PRESENT
= 0x0004,
285 SEC_DESC_DACL_DEFAULTED
= 0x0008,
286 SEC_DESC_SACL_PRESENT
= 0x0010,
287 SEC_DESC_SACL_DEFAULTED
= 0x0020,
288 SEC_DESC_DACL_TRUSTED
= 0x0040,
289 SEC_DESC_SERVER_SECURITY
= 0x0080,
290 SEC_DESC_DACL_AUTO_INHERIT_REQ
= 0x0100,
291 SEC_DESC_SACL_AUTO_INHERIT_REQ
= 0x0200,
292 SEC_DESC_DACL_AUTO_INHERITED
= 0x0400,
293 SEC_DESC_SACL_AUTO_INHERITED
= 0x0800,
294 SEC_DESC_DACL_PROTECTED
= 0x1000,
295 SEC_DESC_SACL_PROTECTED
= 0x2000,
296 SEC_DESC_RM_CONTROL_VALID
= 0x4000,
297 SEC_DESC_SELF_RELATIVE
= 0x8000
298 } security_descriptor_type
;
300 /* bits that determine which parts of a security descriptor
301 are being queried/set */
302 const int SECINFO_OWNER
= 0x00000001;
303 const int SECINFO_GROUP
= 0x00000002;
304 const int SECINFO_DACL
= 0x00000004;
305 const int SECINFO_SACL
= 0x00000008;
307 typedef [public,flag
(NDR_LITTLE_ENDIAN
)] struct {
308 security_descriptor_revision revision
;
309 security_descriptor_type type
; /* SEC_DESC_xxxx flags */
310 [relative
] dom_sid
*owner_sid
;
311 [relative
] dom_sid
*group_sid
;
312 [relative
] security_acl
*sacl
; /* system ACL */
313 [relative
] security_acl
*dacl
; /* user (discretionary) ACL */
314 } security_descriptor
;
316 typedef [public] struct {
317 [range(0,0x40000),value
(ndr_size_security_descriptor
(sd
))] uint32 sd_size
;
318 [subcontext
(4)] security_descriptor
*sd
;